Closed Bug 795899 Opened 12 years ago Closed 12 years ago

Heap-use-after-free in mozilla::layers::ContainerLayer::ComputeEffectiveTransformsForChildren

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86_64
All
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox17 --- unaffected
firefox18 + fixed
firefox-esr10 --- unaffected
firefox-esr17 --- unaffected

People

(Reporter: inferno, Assigned: mattwoodrow)

References

Details

(Keywords: assertion, csectype-uaf, testcase, Whiteboard: [asan][adv-main18+])

Attachments

(3 files)

Testcase
1.95 KB, text/html
Details
Another testcase
701 bytes, text/xml
Details
Remove more of the merged frames code
1.45 KB, patch
roc
: review+
Details | Diff | Splinter Review
Attached file Testcase — 
Reproduces on trunk. To reliably reproduce, run multiple firefox instances on Xvfb screen 1280x1024x24 with this testcase on cmd line.

=================================================================
==32510== ERROR: AddressSanitizer heap-use-after-free on address 0x7fbd8c4c7880 at pc 0x7fbdd3a34512 bp 0x7fffdaa64e70 sp 0x7fffdaa64e68
READ of size 8 at 0x7fbd8c4c7880 thread T0
    #0 0x7fbdd3a34511 in mozilla::layers::ContainerLayer::ComputeEffectiveTransformsForChildren(gfx3DMatrix const&) src/gfx/layers/Layers.cpp:812
    #1 0x7fbdd39bb0fd in void mozilla::layers::ContainerComputeEffectiveTransforms<mozilla::layers::BasicContainerLayer>(gfx3DMatrix const&, mozilla::layers::BasicContainerLayer*) src/gfx/layers/basic/BasicContainerLayer.h:153
    #2 0x7fbdd39b772f in mozilla::layers::BasicContainerLayer::ComputeEffectiveTransforms(gfx3DMatrix const&) src/gfx/layers/basic/BasicContainerLayer.h:217
    #3 0x7fbdd3a34596 in mozilla::layers::ContainerLayer::ComputeEffectiveTransformsForChildren(gfx3DMatrix const&) src/gfx/layers/Layers.cpp:812
    #4 0x7fbdd39bb0fd in void mozilla::layers::ContainerComputeEffectiveTransforms<mozilla::layers::BasicContainerLayer>(gfx3DMatrix const&, mozilla::layers::BasicContainerLayer*) src/gfx/layers/basic/BasicContainerLayer.h:153
    #5 0x7fbdd39b772f in mozilla::layers::BasicContainerLayer::ComputeEffectiveTransforms(gfx3DMatrix const&) src/gfx/layers/basic/BasicContainerLayer.h:217
    #6 0x7fbdd396cb71 in mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/basic/BasicLayerManager.cpp:569
    #7 0x7fbdd396b7b7 in mozilla::layers::BasicLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/basic/BasicLayerManager.cpp:509
    #8 0x7fbdc74c55ae in mozilla::PaintInactiveLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsDisplayItem*, gfxContext*, nsRenderingContext*) src/layout/base/FrameLayerBuilder.cpp:2017
    #9 0x7fbdc74c04e3 in mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*) src/layout/base/FrameLayerBuilder.cpp:3236
    #10 0x7fbdd39dcbe4 in mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) src/gfx/layers/basic/BasicThebesLayer.cpp:139
    #11 0x7fbdd39e0dfe in non-virtual thunk to mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) src/gfx/cairo/cairo/src/cairo-surface-subsurface.c:0
    #12 0x7fbdd3974465 in mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintContext&, gfxContext*) src/gfx/layers/basic/BasicLayerManager.cpp:823
    #13 0x7fbdd3971bac in mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) src/gfx/layers/basic/BasicLayerManager.cpp:944
    #14 0x7fbdd3974a51 in mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintContext&, gfxContext*) src/gfx/layers/basic/BasicLayerManager.cpp:839
    #15 0x7fbdd3971bac in mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) src/gfx/layers/basic/BasicLayerManager.cpp:944
    #16 0x7fbdd396cfd2 in mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/basic/BasicLayerManager.cpp:588
    #17 0x7fbdd396b7b7 in mozilla::layers::BasicLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/basic/BasicLayerManager.cpp:509
    #18 0x7fbdc74c55ae in mozilla::PaintInactiveLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsDisplayItem*, gfxContext*, nsRenderingContext*) src/layout/base/FrameLayerBuilder.cpp:2017
    #19 0x7fbdc74c04e3 in mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*) src/layout/base/FrameLayerBuilder.cpp:3236
    #20 0x7fbdd39dcbe4 in mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) src/gfx/layers/basic/BasicThebesLayer.cpp:139
    #21 0x7fbdd39e0dfe in non-virtual thunk to mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) src/gfx/cairo/cairo/src/cairo-surface-subsurface.c:0
    #22 0x7fbdd3974465 in mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintContext&, gfxContext*) src/gfx/layers/basic/BasicLayerManager.cpp:823
    #23 0x7fbdd3971bac in mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) src/gfx/layers/basic/BasicLayerManager.cpp:944
    #24 0x7fbdd3974a51 in mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintContext&, gfxContext*) src/gfx/layers/basic/BasicLayerManager.cpp:839
    #25 0x7fbdd3971bac in mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) src/gfx/layers/basic/BasicLayerManager.cpp:944
    #26 0x7fbdd396cfd2 in mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/basic/BasicLayerManager.cpp:588
    #27 0x7fbdd396b7b7 in mozilla::layers::BasicLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/basic/BasicLayerManager.cpp:509
    #28 0x7fbdc74c55ae in mozilla::PaintInactiveLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsDisplayItem*, gfxContext*, nsRenderingContext*) src/layout/base/FrameLayerBuilder.cpp:2017
    #29 0x7fbdc74c04e3 in mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*) src/layout/base/FrameLayerBuilder.cpp:3236
    #30 0x7fbdd39e49ef in mozilla::layers::BasicThebesLayer::PaintBuffer(gfxContext*, nsIntRegion const&, nsIntRegion const&, nsIntRegion const&, bool, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*) src/gfx/layers/basic/BasicThebesLayer.h:94
    #31 0x7fbdd39e409e in mozilla::layers::BasicShadowableThebesLayer::PaintBuffer(gfxContext*, nsIntRegion const&, nsIntRegion const&, nsIntRegion const&, bool, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*) src/gfx/layers/basic/BasicThebesLayer.cpp:400
    #32 0x7fbdd39dd7cb in mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) src/gfx/layers/basic/BasicThebesLayer.cpp:189
    #33 0x7fbdd39e1afa in mozilla::layers::BasicShadowableThebesLayer::PaintThebes(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) src/gfx/layers/basic/BasicThebesLayer.cpp:303
    #34 0x7fbdd39e213e in non-virtual thunk to mozilla::layers::BasicShadowableThebesLayer::PaintThebes(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) src/gfx/cairo/cairo/src/cairo-surface-subsurface.c:0
    #35 0x7fbdd3974465 in mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintContext&, gfxContext*) src/gfx/layers/basic/BasicLayerManager.cpp:823
    #36 0x7fbdd39717f5 in mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) src/gfx/layers/basic/BasicLayerManager.cpp:932
    #37 0x7fbdd3974a51 in mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintContext&, gfxContext*) src/gfx/layers/basic/BasicLayerManager.cpp:839
    #38 0x7fbdd39717f5 in mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) src/gfx/layers/basic/BasicLayerManager.cpp:932
    #39 0x7fbdd3974a51 in mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintContext&, gfxContext*) src/gfx/layers/basic/BasicLayerManager.cpp:839
    #40 0x7fbdd39717f5 in mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) src/gfx/layers/basic/BasicLayerManager.cpp:932
    #41 0x7fbdd396cee8 in mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/basic/BasicLayerManager.cpp:584
    #42 0x7fbdd396b7b7 in mozilla::layers::BasicLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/basic/BasicLayerManager.cpp:509
    #43 0x7fbdd397e1e5 in mozilla::layers::BasicShadowLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/basic/BasicLayerManager.cpp:1129
    #44 0x7fbdc7786352 in nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const src/layout/base/nsDisplayList.cpp:1098
    #45 0x7fbdc7783741 in nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) const src/layout/base/nsDisplayList.cpp:966
    #46 0x7fbdc79113e8 in nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) src/layout/base/nsLayoutUtils.cpp:1743
    #47 0x7fbdc7a5c136 in PresShell::Paint(nsIView*, nsRegion const&, nsIPresShell::PaintType, bool) src/layout/base/nsPresShell.cpp:5323
    #48 0x7fbdcb35de9b in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/src/nsViewManager.cpp:436
    #49 0x7fbdcb3713e5 in nsViewManager::ProcessPendingUpdates() src/view/src/nsViewManager.cpp:1210
    #50 0x7fbdc7ad9845 in nsRefreshDriver::Notify(nsITimer*) src/layout/base/nsRefreshDriver.cpp:431
    #51 0x7fbdd313aa5d in nsTimerImpl::Fire() src/xpcom/threads/nsTimerImpl.cpp:476
    #52 0x7fbdd313be7a in nsTimerEvent::Run() src/xpcom/threads/nsTimerImpl.cpp:556
    #53 0x7fbdd30ff580 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:612
    #54 0x7fbdd2d91ecb in NS_ProcessNextEvent_P(nsIThread*, bool) src/objdir-ff-asan-sym/xpcom/build/nsThreadUtils.cpp:220
    #55 0x7fbdd17db3b6 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:82
    #56 0x7fbdd33b7e11 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:208
    #57 0x7fbdd33b7c46 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:201
    #58 0x7fbdd33b7b2b in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:175
    #59 0x7fbdd0c82dda in nsBaseAppShell::Run() src/widget/xpwidgets/nsBaseAppShell.cpp:163
    #60 0x7fbdcf8b59b4 in nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:290
    #61 0x7fbdc5f28a4d in XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:3782
    #62 0x7fbdc5f2e8c5 in XREMain::XRE_main(int, char**, nsXREAppData const*) src/toolkit/xre/nsAppRunner.cpp:3848
    #63 0x7fbdc5f31774 in XRE_main src/toolkit/xre/nsAppRunner.cpp:3923
    #64 0x40d013 in do_main(int, char**) src/browser/app/nsBrowserApp.cpp:174
    #65 0x40a755 in main src/browser/app/nsBrowserApp.cpp:279
    #66 0x7fbde3e26c4c in ?? ??:0
0x7fbd8c4c7880 is located 0 bytes inside of 616-byte region [0x7fbd8c4c7880,0x7fbd8c4c7ae8)
freed by thread T0 here:
    #0 0x4c4af0 in free ??:0
    #1 0x7fbde0cb2586 in moz_free src/memory/mozalloc/mozalloc.cpp:51
    #2 0x7fbdd39b11cd in operator delete(void*) src/../../dist/include/mozilla/mozalloc.h:224
    #3 0x7fbdc74d055b in mozilla::layers::Layer::Release() src/gfx/layers/Layers.h:514
    #4 0x7fbdc74df755 in ~nsRefPtr src/../../dist/include/nsAutoPtr.h:874
    #5 0x7fbdc7490ac6 in ~nsRefPtr src/../../dist/include/nsAutoPtr.h:872
    #6 0x7fbdd3b37410 in ~LayerPropertiesBase src/gfx/layers/LayerTreeInvalidation.cpp:89
    #7 0x7fbdd3b3e30a in mozilla::layers::ContainerLayerProperties::~ContainerLayerProperties() src/gfx/layers/LayerTreeInvalidation.cpp:162
    #8 0x7fbdd3b3c806 in mozilla::layers::ContainerLayerProperties::~ContainerLayerProperties() src/gfx/layers/LayerTreeInvalidation.cpp:162
    #9 0x7fbdd3b3c93c in mozilla::layers::ContainerLayerProperties::~ContainerLayerProperties() src/gfx/layers/LayerTreeInvalidation.cpp:162
    #10 0x7fbdd3b377ef in ~nsAutoPtr src/../../dist/include/nsAutoPtr.h:71
    #11 0x7fbdd3b37526 in ~nsAutoPtr src/../../dist/include/nsAutoPtr.h:70
    #12 0x7fbdd3b3f286 in nsTArrayElementTraits<nsAutoPtr<mozilla::layers::LayerPropertiesBase> >::Destruct(nsAutoPtr<mozilla::layers::LayerPropertiesBase>*) src/../../dist/include/nsTArray.h:360
    #13 0x7fbdd3b3f101 in nsTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, nsTArrayDefaultAllocator>::DestructRange(unsigned int, unsigned int) src/../../dist/include/nsTArray.h:1225
    #14 0x7fbdd3b3eb68 in nsTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, nsTArrayDefaultAllocator>::RemoveElementsAt(unsigned int, unsigned int) src/../../dist/include/nsTArray.h:945
    #15 0x7fbdd3b3e882 in nsTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, nsTArrayDefaultAllocator>::Clear() src/../../dist/include/nsTArray.h:956
    #16 0x7fbdd3b3e74e in ~nsTArray src/../../dist/include/nsTArray.h:442
    #17 0x7fbdd3b3e639 in nsAutoArrayBase<nsTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, nsTArrayDefaultAllocator>, 1u>::~nsAutoArrayBase() src/../../dist/include/nsTArray.h:1303
    #18 0x7fbdd3b3e529 in nsAutoTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, 1u, nsTArrayDefaultAllocator>::~nsAutoTArray() src/../../dist/include/nsTArray.h:1357
    #19 0x7fbdd3b3e416 in nsAutoTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, 1u, nsTArrayDefaultAllocator>::~nsAutoTArray() src/../../dist/include/nsTArray.h:1357
    #20 0x7fbdd3b3e2fd in mozilla::layers::ContainerLayerProperties::~ContainerLayerProperties() src/gfx/layers/LayerTreeInvalidation.cpp:162
    #21 0x7fbdd3b3c806 in mozilla::layers::ContainerLayerProperties::~ContainerLayerProperties() src/gfx/layers/LayerTreeInvalidation.cpp:162
    #22 0x7fbdd3b3c93c in mozilla::layers::ContainerLayerProperties::~ContainerLayerProperties() src/gfx/layers/LayerTreeInvalidation.cpp:162
    #23 0x7fbdd3b377ef in ~nsAutoPtr src/../../dist/include/nsAutoPtr.h:71
    #24 0x7fbdd3b37526 in ~nsAutoPtr src/../../dist/include/nsAutoPtr.h:70
    #25 0x7fbdd3b3f286 in nsTArrayElementTraits<nsAutoPtr<mozilla::layers::LayerPropertiesBase> >::Destruct(nsAutoPtr<mozilla::layers::LayerPropertiesBase>*) src/../../dist/include/nsTArray.h:360
    #26 0x7fbdd3b3f101 in nsTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, nsTArrayDefaultAllocator>::DestructRange(unsigned int, unsigned int) src/../../dist/include/nsTArray.h:1225
    #27 0x7fbdd3b3eb68 in nsTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, nsTArrayDefaultAllocator>::RemoveElementsAt(unsigned int, unsigned int) src/../../dist/include/nsTArray.h:945
    #28 0x7fbdd3b3e882 in nsTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, nsTArrayDefaultAllocator>::Clear() src/../../dist/include/nsTArray.h:956
    #29 0x7fbdd3b3e74e in ~nsTArray src/../../dist/include/nsTArray.h:442
previously allocated by thread T0 here:
    #0 0x4c4bb0 in __interceptor_malloc ??:0
    #1 0x7fbde0cb26da in moz_xmalloc src/memory/mozalloc/mozalloc.cpp:57
    #2 0x7fbdd39b42f0 in operator new(unsigned long) src/../../dist/include/mozilla/mozalloc.h:200
    #3 0x7fbdc74ac836 in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2797
    #4 0x7fbdc77d8c68 in nsDisplayTransform::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:3737
    #5 0x7fbdc74b5af4 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2125
    #6 0x7fbdc74ae0bb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #7 0x7fbdc77b68ba in nsDisplayOpacity::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:2574
    #8 0x7fbdc74b5af4 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2125
    #9 0x7fbdc74ae0bb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #10 0x7fbdc77d8c68 in nsDisplayTransform::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:3737
    #11 0x7fbdc74a2b39 in mozilla::FrameLayerBuilder::AddThebesDisplayItem(mozilla::layers::ThebesLayer*, nsDisplayItem*, mozilla::FrameLayerBuilder::Clip const&, nsIFrame*, mozilla::LayerState, nsPoint const&) src/layout/base/FrameLayerBuilder.cpp:2373
    #12 0x7fbdc74b6f2c in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2200
    #13 0x7fbdc74ae0bb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #14 0x7fbdc77b68ba in nsDisplayOpacity::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:2574
    #15 0x7fbdc74a2b39 in mozilla::FrameLayerBuilder::AddThebesDisplayItem(mozilla::layers::ThebesLayer*, nsDisplayItem*, mozilla::FrameLayerBuilder::Clip const&, nsIFrame*, mozilla::LayerState, nsPoint const&) src/layout/base/FrameLayerBuilder.cpp:2373
    #16 0x7fbdc74b6f2c in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2200
    #17 0x7fbdc74ae0bb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #18 0x7fbdc77d8c68 in nsDisplayTransform::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:3737
    #19 0x7fbdc74a2b39 in mozilla::FrameLayerBuilder::AddThebesDisplayItem(mozilla::layers::ThebesLayer*, nsDisplayItem*, mozilla::FrameLayerBuilder::Clip const&, nsIFrame*, mozilla::LayerState, nsPoint const&) src/layout/base/FrameLayerBuilder.cpp:2373
    #20 0x7fbdc74b6f2c in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2200
    #21 0x7fbdc74b478e in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2063
    #22 0x7fbdc74ae0bb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #23 0x7fbdc77bc4c2 in nsDisplayOwnLayer::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:2670
    #24 0x7fbdc74b5af4 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2125
Shadow byte and word:
  0x1ff7b1898f10: fd
  0x1ff7b1898f10: fd fd fd fd fd fd fd fd
More shadow bytes:
  0x1ff7b1898ef0: fa fa fa fa fa fa fa fa
  0x1ff7b1898ef8: fa fa fa fa fa fa fa fa
  0x1ff7b1898f00: fa fa fa fa fa fa fa fa
  0x1ff7b1898f08: fa fa fa fa fa fa fa fa
=>0x1ff7b1898f10: fd fd fd fd fd fd fd fd
  0x1ff7b1898f18: fd fd fd fd fd fd fd fd
  0x1ff7b1898f20: fd fd fd fd fd fd fd fd
  0x1ff7b1898f28: fd fd fd fd fd fd fd fd
  0x1ff7b1898f30: fd fd fd fd fd fd fd fd
Stats: 245M malloced (262M for red zones) by 396542 calls
Stats: 42M realloced by 22212 calls
Stats: 222M freed by 288712 calls
Stats: 90M really freed by 166126 calls
Stats: 456M (116821 full pages) mmaped in 114 calls
  mmaps   by size class: 8:245745; 9:32764; 10:12285; 11:14329; 12:2048; 13:1536; 14:1280; 15:384; 16:896; 17:1248; 18:144; 19:40; 20:20;
  mallocs by size class: 8:319583; 9:38443; 10:13358; 11:16867; 12:2163; 13:1785; 14:1427; 15:340; 16:1048; 17:1307; 18:159; 19:41; 20:21;
  frees   by size class: 8:227561; 9:29941; 10:10375; 11:13698; 12:1481; 13:1619; 14:1259; 15:302; 16:982; 17:1292; 18:145; 19:39; 20:18;
  rfrees  by size class: 8:142838; 9:8750; 10:2094; 11:9285; 12:649; 13:516; 14:548; 15:182; 16:794; 17:441; 18:24; 19:4; 20:1;
Stats: malloc large: 1528 small slow: 2168
==32510== ABORTING
I can't reproduce the crash in a Linux64 debug+asan build, but I do see many:
###!!! ASSERTION: Layer already in list???: '!mNewChildLayers.Contains(ownLayer)', layout/base/FrameLayerBuilder.cpp, line 2183
(in an up-to-date mozilla-central tree, rev 63b393c1facc)

Fwiw, that assertion was also mentioned in bug 785626... so maybe bug 785333
did not completely fix it?
Component: General → Layout
Keywords: assertion, testcase
Product: Firefox → Core
Whiteboard: [asan]
Mats, you might wanna try >10-12 firefox instances at once on a Xvfb display [Xvfb :1 -screen 0 1280x1024x24 &] and display manager blackbox [DISPLAY=:1 blackbox &]. If it does not reproduce, i can try out a potential patch since it reliably reproduces on my box.
Attached file Another testcase — 
Another similar looking repro with same free stack and reproduces easily with single firefox instance.

=================================================================
==24628== ERROR: AddressSanitizer heap-use-after-free on address 0x7f2ca30dec80 at pc 0x7f2cd011cf8f bp 0x7fff1d00ba70 sp 0x7fff1d00ba68
READ of size 8 at 0x7f2ca30dec80 thread T0
    #0 0x7f2cd011cf8e in mozilla::FrameLayerBuilder::ProcessRemovedDisplayItems(mozilla::FrameLayerBuilder::DisplayItemDataEntry*, void*) src/layout/base/FrameLayerBuilder.cpp:954
    #1 0x7f2cd015b90b in nsTHashtable<mozilla::FrameLayerBuilder::DisplayItemDataEntry>::s_EnumStub(PLDHashTable*, PLDHashEntryHdr*, unsigned int, void*) src/../../dist/include/nsTHashtable.h:485
    #2 0x7f2cdba4ecc5 in PL_DHashTableEnumerate src/objdir-ff-asan-sym/xpcom/build/pldhash.cpp:716
    #3 0x7f2cd011b8a2 in nsTHashtable<mozilla::FrameLayerBuilder::DisplayItemDataEntry>::EnumerateEntries(PLDHashOperator (*)(mozilla::FrameLayerBuilder::DisplayItemDataEntry*, void*), void*) src/../../dist/include/nsTHashtable.h:238
    #4 0x7f2cd013a2b2 in mozilla::(anonymous namespace)::ContainerState::Finish(unsigned int*, mozilla::LayerManagerData*) src/layout/base/FrameLayerBuilder.cpp:2578
    #5 0x7f2cd013091a in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2875
    #6 0x7f2cd043d7f2 in nsDisplayOwnLayer::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:2670
    #7 0x7f2cd0138304 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2125
    #8 0x7f2cd01308cb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #9 0x7f2cd043d7f2 in nsDisplayOwnLayer::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:2670
    #10 0x7f2cd0138304 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2125
    #11 0x7f2cd0136f9e in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2063
    #12 0x7f2cd0136f9e in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2063
    #13 0x7f2cd01308cb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #14 0x7f2cd0406598 in nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const src/layout/base/nsDisplayList.cpp:1043
    #15 0x7f2cd0404a71 in nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) const src/layout/base/nsDisplayList.cpp:966
    #16 0x7f2cd0592718 in nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) src/layout/base/nsLayoutUtils.cpp:1743
    #17 0x7f2cd06dd526 in PresShell::Paint(nsIView*, nsRegion const&, nsIPresShell::PaintType, bool) src/layout/base/nsPresShell.cpp:5323
    #18 0x7f2cd3fe9bfb in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/src/nsViewManager.cpp:436
    #19 0x7f2cd3ffd145 in nsViewManager::ProcessPendingUpdates() src/view/src/nsViewManager.cpp:1210
    #20 0x7f2cd075ac35 in nsRefreshDriver::Notify(nsITimer*) src/layout/base/nsRefreshDriver.cpp:431
    #21 0x7f2cdbde246d in nsTimerImpl::Fire() src/xpcom/threads/nsTimerImpl.cpp:476
    #22 0x7f2cdbde388a in nsTimerEvent::Run() src/xpcom/threads/nsTimerImpl.cpp:556
    #23 0x7f2cdbda6f90 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:612
    #24 0x7f2cdba398db in NS_ProcessNextEvent_P(nsIThread*, bool) src/objdir-ff-asan-sym/xpcom/build/nsThreadUtils.cpp:220
    #25 0x7f2cda4800bd in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:117
    #26 0x7f2cdc061e61 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:208
    #27 0x7f2cdc061c96 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:201
    #28 0x7f2cdc061b7b in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:175
    #29 0x7f2cd992747a in nsBaseAppShell::Run() src/widget/xpwidgets/nsBaseAppShell.cpp:163
    #30 0x7f2cd855a054 in nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:290
    #31 0x7f2cceb9b49d in XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:3782
    #32 0x7f2cceba1315 in XREMain::XRE_main(int, char**, nsXREAppData const*) src/toolkit/xre/nsAppRunner.cpp:3848
    #33 0x7f2cceba41c4 in XRE_main src/toolkit/xre/nsAppRunner.cpp:3923
    #34 0x40d013 in do_main(int, char**) src/browser/app/nsBrowserApp.cpp:174
    #35 0x40a755 in main src/browser/app/nsBrowserApp.cpp:279
    #36 0x7f2cecb1fc4c in ?? ??:0
0x7f2ca30dec80 is located 0 bytes inside of 632-byte region [0x7f2ca30dec80,0x7f2ca30deef8)
freed by thread T0 here:
    #0 0x4c4af0 in free ??:0
    #1 0x7f2ce99aa586 in moz_free src/memory/mozalloc/mozalloc.cpp:51
    #2 0x7f2cdc66245d in operator delete(void*) src/../../dist/include/mozilla/mozalloc.h:224
    #3 0x7f2cd0152d6b in mozilla::layers::Layer::Release() src/gfx/layers/Layers.h:514
    #4 0x7f2cd0161f65 in ~nsRefPtr src/../../dist/include/nsAutoPtr.h:874
    #5 0x7f2cd0113bf6 in ~nsRefPtr src/../../dist/include/nsAutoPtr.h:872
    #6 0x7f2cdc7e2023 in ~LayerPropertiesBase src/gfx/layers/LayerTreeInvalidation.cpp:89
    #7 0x7f2cdc7e918a in mozilla::layers::ContainerLayerProperties::~ContainerLayerProperties() src/gfx/layers/LayerTreeInvalidation.cpp:166
    #8 0x7f2cdc7e7686 in mozilla::layers::ContainerLayerProperties::~ContainerLayerProperties() src/gfx/layers/LayerTreeInvalidation.cpp:166
    #9 0x7f2cdc7e77bc in mozilla::layers::ContainerLayerProperties::~ContainerLayerProperties() src/gfx/layers/LayerTreeInvalidation.cpp:166
    #10 0x7f2cdc7e23ff in ~nsAutoPtr src/../../dist/include/nsAutoPtr.h:71
    #11 0x7f2cdc7e2136 in ~nsAutoPtr src/../../dist/include/nsAutoPtr.h:70
    #12 0x7f2cdc7ea106 in nsTArrayElementTraits<nsAutoPtr<mozilla::layers::LayerPropertiesBase> >::Destruct(nsAutoPtr<mozilla::layers::LayerPropertiesBase>*) src/../../dist/include/nsTArray.h:360
    #13 0x7f2cdc7e9f81 in nsTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, nsTArrayDefaultAllocator>::DestructRange(unsigned int, unsigned int) src/../../dist/include/nsTArray.h:1225
    #14 0x7f2cdc7e99e8 in nsTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, nsTArrayDefaultAllocator>::RemoveElementsAt(unsigned int, unsigned int) src/../../dist/include/nsTArray.h:945
    #15 0x7f2cdc7e9702 in nsTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, nsTArrayDefaultAllocator>::Clear() src/../../dist/include/nsTArray.h:956
    #16 0x7f2cdc7e95ce in ~nsTArray src/../../dist/include/nsTArray.h:442
    #17 0x7f2cdc7e94b9 in nsAutoArrayBase<nsTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, nsTArrayDefaultAllocator>, 1u>::~nsAutoArrayBase() src/../../dist/include/nsTArray.h:1303
    #18 0x7f2cdc7e93a9 in nsAutoTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, 1u, nsTArrayDefaultAllocator>::~nsAutoTArray() src/../../dist/include/nsTArray.h:1357
    #19 0x7f2cdc7e9296 in nsAutoTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, 1u, nsTArrayDefaultAllocator>::~nsAutoTArray() src/../../dist/include/nsTArray.h:1357
    #20 0x7f2cdc7e917d in mozilla::layers::ContainerLayerProperties::~ContainerLayerProperties() src/gfx/layers/LayerTreeInvalidation.cpp:166
    #21 0x7f2cdc7e7686 in mozilla::layers::ContainerLayerProperties::~ContainerLayerProperties() src/gfx/layers/LayerTreeInvalidation.cpp:166
    #22 0x7f2cdc7e77bc in mozilla::layers::ContainerLayerProperties::~ContainerLayerProperties() src/gfx/layers/LayerTreeInvalidation.cpp:166
    #23 0x7f2cdc7e23ff in ~nsAutoPtr src/../../dist/include/nsAutoPtr.h:71
    #24 0x7f2cdc7e2136 in ~nsAutoPtr src/../../dist/include/nsAutoPtr.h:70
    #25 0x7f2cdc7ea106 in nsTArrayElementTraits<nsAutoPtr<mozilla::layers::LayerPropertiesBase> >::Destruct(nsAutoPtr<mozilla::layers::LayerPropertiesBase>*) src/../../dist/include/nsTArray.h:360
    #26 0x7f2cdc7e9f81 in nsTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, nsTArrayDefaultAllocator>::DestructRange(unsigned int, unsigned int) src/../../dist/include/nsTArray.h:1225
    #27 0x7f2cdc7e99e8 in nsTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, nsTArrayDefaultAllocator>::RemoveElementsAt(unsigned int, unsigned int) src/../../dist/include/nsTArray.h:945
    #28 0x7f2cdc7e9702 in nsTArray<nsAutoPtr<mozilla::layers::LayerPropertiesBase>, nsTArrayDefaultAllocator>::Clear() src/../../dist/include/nsTArray.h:956
    #29 0x7f2cdc7e95ce in ~nsTArray src/../../dist/include/nsTArray.h:442
previously allocated by thread T0 here:
    #0 0x4c4bb0 in __interceptor_malloc ??:0
    #1 0x7f2ce99aa6da in moz_xmalloc src/memory/mozalloc/mozalloc.cpp:57
    #2 0x7f2cdc65f24c in operator new(unsigned long) src/../../dist/include/mozilla/mozalloc.h:200
    #3 0x7f2cd012f046 in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2797
    #4 0x7f2cd0437bea in nsDisplayOpacity::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:2574
    #5 0x7f2cd0138304 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2125
    #6 0x7f2cd01308cb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #7 0x7f2cd0437bea in nsDisplayOpacity::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:2574
    #8 0x7f2cd0138304 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2125
    #9 0x7f2cd01308cb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #10 0x7f2cd0437bea in nsDisplayOpacity::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:2574
    #11 0x7f2cd0138304 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2125
    #12 0x7f2cd01308cb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #13 0x7f2cd0459f98 in nsDisplayTransform::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:3737
    #14 0x7f2cd0138304 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2125
    #15 0x7f2cd0136f9e in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2063
    #16 0x7f2cd01308cb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #17 0x7f2cd043d7f2 in nsDisplayOwnLayer::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:2670
    #18 0x7f2cd0138304 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2125
    #19 0x7f2cd0136f9e in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2063
    #20 0x7f2cd0136f9e in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2063
    #21 0x7f2cd01308cb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #22 0x7f2cd0406598 in nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const src/layout/base/nsDisplayList.cpp:1043
    #23 0x7f2cd0404a71 in nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) const src/layout/base/nsDisplayList.cpp:966
    #24 0x7f2cd0592718 in nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) src/layout/base/nsLayoutUtils.cpp:1743
Shadow byte and word:
  0x1fe59461bd90: fd
  0x1fe59461bd90: fd fd fd fd fd fd fd fd
More shadow bytes:
  0x1fe59461bd70: fd fd fd fd fd fd fd fd
  0x1fe59461bd78: fd fd fd fd fd fd fd fd
  0x1fe59461bd80: fa fa fa fa fa fa fa fa
  0x1fe59461bd88: fa fa fa fa fa fa fa fa
=>0x1fe59461bd90: fd fd fd fd fd fd fd fd
  0x1fe59461bd98: fd fd fd fd fd fd fd fd
  0x1fe59461bda0: fd fd fd fd fd fd fd fd
  0x1fe59461bda8: fd fd fd fd fd fd fd fd
  0x1fe59461bdb0: fd fd fd fd fd fd fd fd
Stats: 287M malloced (322M for red zones) by 578793 calls
Stats: 51M realloced by 34254 calls
Stats: 259M freed by 418404 calls
Stats: 127M really freed by 231892 calls
Stats: 524M (134240 full pages) mmaped in 131 calls
  mmaps   by size class: 8:311277; 9:40955; 10:16380; 11:14329; 12:3072; 13:2048; 14:1280; 15:384; 16:1024; 17:1248; 18:256; 19:40; 20:20;
  mallocs by size class: 8:489956; 9:45848; 10:15591; 11:17143; 12:2917; 13:2322; 14:1756; 15:345; 16:1275; 17:1309; 18:269; 19:41; 20:21;
  frees   by size class: 8:345650; 9:37433; 10:12423; 11:13921; 12:2162; 13:2141; 14:1569; 15:303; 16:1213; 17:1292; 18:240; 19:39; 20:18;
  rfrees  by size class: 8:200957; 9:13489; 10:3075; 11:9727; 12:989; 13:793; 14:857; 15:215; 16:947; 17:812; 18:26; 19:4; 20:1;
Stats: malloc large: 1640 small slow: 2758
==24628== ABORTING
Thanks so much for the testcases!

Looks like this was a merged nsDisplayOpacity that then becomes two separate nsDisplayOpacity items. We have recorded DisplayItemData for both frames, and then we return the same ContainerLayer for each items separately. Panic ensues.
Attachment #667177 - Flags: review?(roc)
Fairly sure this is the same problem as bugs 795728 and 795889 too.
Can i be cced on 795889.
https://hg.mozilla.org/mozilla-central/rev/0c23e26472bb
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Can we land these tests as crashtests?  I think this is going to make life easier in the refactoring ;).
Matt - is this related to DLBI? We're trying to figure out if the ESR10 branch is affected.
(In reply to Abhishek Arya from comment #6)
> Can i be cced on 795889.

That's a crash in a private project that we can't add you to. There's no new information there about the crash though so you're not missing anything. The fix is here.
Blocks: dlbi
status-firefox-esr10: --- → unaffected
status-firefox17: --- → unaffected
status-firefox18: --- → fixed
tracking-firefox18: --- → +
Alex: Yes it is.
Assignee: nobody → matt.woodrow
status-firefox-esr17: --- → unaffected
Whiteboard: [asan] → [asan][adv-main18+]
Group: core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: